[Declude.JunkMail] DYNHELO Test
Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
Any feedback on these tests and performance will be appreciated here is some info on these tests. BCC bcc 10 x 5 0 This test type, checks to see if there are more than X known BCC:'s for this E-mail (where X is the first test-type-specific piece of information set to 10 in this example). It simply goes through each recipient, and checks to see if the E-mail contains the E-mail address of the recipient. The first piece of test-type-specific information is the minimum number of BCC:'s required in order for the E-mail to fail the test. DYNHELO dynhelo x x 5 0 This test type, attempts to detect dynamic IPs in HELO/EHLO hostnames. This test should be quite effective, since mailservers on IPs that have dynamic-like reverse DNS entries will *not* normally send an HELO/EHLO that looks dynamic. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 1:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. __ NOD32 1.1058 (20050412) Information __ This message was checked by NOD32 antivirus system. http://www.nod32.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
On 12 Apr 2005 at 13:16, David Barker wrote: Hi David, BCC bcc 10 x 5 0 This test type, checks to see if there are more than X known BCC:'s I think Darrell's question was related to optimum setting rather than functionality. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
Darrell.. The BCC test to me is scary if used by itself- I can see it being used as a combo test but alone with any weight is not something I would use. We have clients that use their outlook and send 50+ people in a single BCC .. Emails to boards and volunteer groups in nonprofits and political groups are quite typical with large BCC. Just my 2 cents.. Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 1:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
Yes, I agree, I thought I would post it anyway as he had said he could not find any info of these tests in the manual. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Sent: Tuesday, April 12, 2005 1:22 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test On 12 Apr 2005 at 13:16, David Barker wrote: Hi David, BCC bcc 10 x 5 0 This test type, checks to see if there are more than X known BCC:'s I think Darrell's question was related to optimum setting rather than functionality. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. __ NOD32 1.1058 (20050412) Information __ This message was checked by NOD32 antivirus system. http://www.nod32.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
Hi Darrell: I have a number tests like the following: == TESTSFAILED END CONTAINS [MULTIPLE.COMBO. MINWEIGHTTOFAIL 4 MAXWEIGHT4 TESTSFAILED 1 CONTAINS [COMBO.AHBL] TESTSFAILED 1 CONTAINS [COMBO.RFC-IGNORANT] TESTSFAILED 1 CONTAINS [COMBO.DNSBL] TESTSFAILED 1 CONTAINS [COMBO.DSBL] TESTSFAILED 1 CONTAINS [COMBO.BLITZED] TESTSFAILED 1 CONTAINS [COMBO.ABUSEAT] TESTSFAILED 1 CONTAINS [COMBO.FIVETEN] TESTSFAILED 1 CONTAINS [COMBO.MAILPOLICE.rhsbl] TESTSFAILED 1 CONTAINS [COMBO.MAILPOLICE.dnsbl.DYNA] TESTSFAILED 1 CONTAINS [COMBO.NJABL] TESTSFAILED 1 CONTAINS [COMBO.SPAMHAUS] TESTSFAILED 1 CONTAINS [COMBO.SORBS] TESTSFAILED 1 CONTAINS [COMBO.MPBL] TESTSFAILED 1 CONTAINS [COMBO.SPAMCOP] TESTSFAILED 1 CONTAINS [COMBO.XBL] TESTSFAILED 1 CONTAINS [COMBO.MAILPOLICE] == This is Multiple_Combo_4 I have this as th first test- then I have _3, _2, and _1 This tells me how many of these groups a test has failed. My test names are based following an OO model. So thes tests are called: [MULTIPLE.COMBO.1.2.3.4] [MULTIPLE.COMBO.1.2.3] [MULTIPLE.COMBO.1.2] [MULTIPLE.COMBO.1] Then I have combo filters that for example have: TESTSFAILED 0 CONTAINS[MULTIPLE.COMBO.1.2. That tells me if at least 2 groups have failed. The above will fail for 2, 3, or 4 groups So having said all the above- I have elevation tests that are based on various factors and the above combination. So in this case I think a logical step would be: - has more than 2 tests failed - does the email have more than 5 BCC's - etc. I have not played with BCC yet but if I were to do it I would definitely test it with failure with at least 2 other ip4r groups and perhaps REVDNS and HOLO_IP test. Hope that helps. Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 2:07 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] DYNHELO Test Kami, Excellent point - what would you combo this with? Darrell Kami Razvan writes: Darrell.. The BCC test to me is scary if used by itself- I can see it being used as a combo test but alone with any weight is not something I would use. We have clients that use their outlook and send 50+ people in a single BCC .. Emails to boards and volunteer groups in nonprofits and political groups are quite typical with large BCC. Just my 2 cents.. Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 1:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
Kami, the BCC test will probably be a good marriage with any DYNA or DUL tests. In general, I think that the BCC test will be of most use to people who run a gateway scenario, where they don't have envelope rejection of addresses. Since I have that configuration, I can offer the observation that directory-attack-lite is very common with BCCs to common prefixed names at my domain, e.g. alice@, bob@, smith@, jones@ etc. When you have envelope rejection, whether because the mailboxes are local, or because you're using Sandy's alias scripts (see his email signature for the links), any BCCs that are bogus are weeded out before IMail saves the envelope file and passes it and the message to Declude. When you have a gateway or a [EMAIL PROTECTED] then all email addresses are accepted, and your server sees an inflated number of TO: and CC: and BCC: entries as the bad guys guess common names at your organization. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Tuesday, April 12, 2005 11:21 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Hi Darrell: I have a number tests like the following: == TESTSFAILED END CONTAINS [MULTIPLE.COMBO. MINWEIGHTTOFAIL 4 MAXWEIGHT4 TESTSFAILED 1 CONTAINS [COMBO.AHBL] TESTSFAILED 1 CONTAINS [COMBO.RFC-IGNORANT] TESTSFAILED 1 CONTAINS [COMBO.DNSBL] TESTSFAILED 1 CONTAINS [COMBO.DSBL] TESTSFAILED 1 CONTAINS [COMBO.BLITZED] TESTSFAILED 1 CONTAINS [COMBO.ABUSEAT] TESTSFAILED 1 CONTAINS [COMBO.FIVETEN] TESTSFAILED 1 CONTAINS [COMBO.MAILPOLICE.rhsbl] TESTSFAILED 1 CONTAINS [COMBO.MAILPOLICE.dnsbl.DYNA] TESTSFAILED 1 CONTAINS [COMBO.NJABL] TESTSFAILED 1 CONTAINS [COMBO.SPAMHAUS] TESTSFAILED 1 CONTAINS [COMBO.SORBS] TESTSFAILED 1 CONTAINS [COMBO.MPBL] TESTSFAILED 1 CONTAINS [COMBO.SPAMCOP] TESTSFAILED 1 CONTAINS [COMBO.XBL] TESTSFAILED 1 CONTAINS [COMBO.MAILPOLICE] == This is Multiple_Combo_4 I have this as th first test- then I have _3, _2, and _1 This tells me how many of these groups a test has failed. My test names are based following an OO model. So thes tests are called: [MULTIPLE.COMBO.1.2.3.4] [MULTIPLE.COMBO.1.2.3] [MULTIPLE.COMBO.1.2] [MULTIPLE.COMBO.1] Then I have combo filters that for example have: TESTSFAILED 0 CONTAINS[MULTIPLE.COMBO.1.2. That tells me if at least 2 groups have failed. The above will fail for 2, 3, or 4 groups So having said all the above- I have elevation tests that are based on various factors and the above combination. So in this case I think a logical step would be: - has more than 2 tests failed - does the email have more than 5 BCC's - etc. I have not played with BCC yet but if I were to do it I would definitely test it with failure with at least 2 other ip4r groups and perhaps REVDNS and HOLO_IP test. Hope that helps. Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 2:07 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] DYNHELO Test Kami, Excellent point - what would you combo this with? Darrell Kami Razvan writes: Darrell.. The BCC test to me is scary if used by itself- I can see it being used as a combo test but alone with any weight is not something I would use. We have clients that use their outlook and send 50+ people in a single BCC .. Emails to boards and volunteer groups in nonprofits and political groups are quite typical with large BCC. Just my 2 cents.. Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 1:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail
RE: [Declude.JunkMail] DYNHELO Test
I've found the new DYNHELO test to be quite useful and I've subsequently stopped using Bud's free external tool (HELOisIP from http://bud.thedurlands.com/ ). I found it just as effective as HELOisIP, and HELOisIPx wasn't worth running the few extra hits I was getting, plus, the hits I was getting with HELOisIPx were already getting scored quite high, so I've stopped using that too. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, April 12, 2005 10:17 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Any feedback on these tests and performance will be appreciated here is some info on these tests. BCC bcc 10 x 5 0 This test type, checks to see if there are more than X known BCC:'s for this E-mail (where X is the first test-type-specific piece of information set to 10 in this example). It simply goes through each recipient, and checks to see if the E-mail contains the E-mail address of the recipient. The first piece of test-type-specific information is the minimum number of BCC:'s required in order for the E-mail to fail the test. DYNHELO dynhelo x x 5 0 This test type, attempts to detect dynamic IPs in HELO/EHLO hostnames. This test should be quite effective, since mailservers on IPs that have dynamic-like reverse DNS entries will *not* normally send an HELO/EHLO that looks dynamic. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 1:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. __ NOD32 1.1058 (20050412) Information __ This message was checked by NOD32 antivirus system. http://www.nod32.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DYNHELO Test
I use these settings fior BCC: BCC-5 bcc 5 x 15 0 BCC-10 bcc 10 x 10 0 subject tag at 100, hold at 200, delete at 300. March (BCC5 7177 spam, 268 ham) March (BCC5 2418 spam, 87 ham) Since the overwhelming majority of my foreign BCC's are spam (this April 2219/2200 are spam), I also have a filter: COMBO-BADCOUNTRY-BCC filter D:\IMail\Declude\FPFilters\COMBO-BADCOUNTRY-BCC.txt x 0 0 COUNTRY END IS US TESTSFAILED 10 CONTAINS BCC-5 TESTSFAILED 15 CONTAINS BCC-10 So worse case a foreign with 10 of BCC would get the mail half of the way to the subject tag weight - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, April 12, 2005 12:33 PM Subject: RE: [Declude.JunkMail] DYNHELO Test Darrell.. The BCC test to me is scary if used by itself- I can see it being used as a combo test but alone with any weight is not something I would use. We have clients that use their outlook and send 50+ people in a single BCC .. Emails to boards and volunteer groups in nonprofits and political groups are quite typical with large BCC. Just my 2 cents.. Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 1:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
On 12 Apr 2005 at 11:38, Colbeck, Andrew wrote: I've found the new DYNHELO test to be quite useful and I've subsequently stopped using Bud's free external tool (HELOisIP from http://bud.thedurlands.com/ ). Thanks Andrew - [sorry Bud} I will follow your lead and do the same - -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
Hm - I looked at http://www.declude.com/Version/Manuals/2.0.6.asp - but don't find any DYNHELO? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 01:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DYNHELO Test
I noted in in the global.cfg file for 2.06. I believe these tests to be new: DYNHELO dynhelo x x 7 0 ENCODEDURL encodedurl x x 1 0 IPURL ipurl x x 2 0 - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, April 12, 2005 2:35 PM Subject: RE: [Declude.JunkMail] DYNHELO Test Hm - I looked at http://www.declude.com/Version/Manuals/2.0.6.asp - but don't find any DYNHELO? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 01:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
I'm surprised the encodedURL is ranked to low? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Tuesday, April 12, 2005 04:01 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] DYNHELO Test I noted in in the global.cfg file for 2.06. I believe these tests to be new: DYNHELO dynhelo x x 7 0 ENCODEDURL encodedurl x x 1 0 IPURL ipurl x x 2 0 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
http://www.declude.com/Articles.asp?ID=151 Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Tuesday, April 12, 2005 3:35 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Hm - I looked at http://www.declude.com/Version/Manuals/2.0.6.asp - but don't find any DYNHELO? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 01:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
Why is IPURL listed as Currently N/A ? Not Applicable? To what? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Tuesday, April 12, 2005 4:14 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test http://www.declude.com/Articles.asp?ID=151 Regards, - Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Tuesday, April 12, 2005 3:35 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Hm - I looked at http://www.declude.com/Version/Manuals/2.0.6.asp - but don't find any DYNHELO? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, April 12, 2005 01:12 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] DYNHELO Test Is anyone using the DYNHELO test in Declude - if so do you have any information on it? What specifically is it looking for? False positive rate?I found it in the new global.cfg file, but did not see any references to it in the manual. Also, for the BCC test any thoughts on what the sweet spot tends to be - by default it comes at 10. Has anyone tweaked this? Darrell -- Try invURIBL - an advanced URI filtering test that will block more than 85% of all SPAM with the default configuration? Try it for free http://www.invariantsystems.com/invuribl/default.htm --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
Probably meant not available (at the time). Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Horne Sent: Tuesday, April 12, 2005 05:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Why is IPURL listed as Currently N/A ? Not Applicable? To what? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DYNHELO Test
Is it available now? Is it working in 2.0.6? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Tuesday, April 12, 2005 5:16 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Probably meant not available (at the time). Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Horne Sent: Tuesday, April 12, 2005 05:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Why is IPURL listed as Currently N/A ? Not Applicable? To what? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DYNHELO Test
That is correct, these two tests were among several tests added to the global.cfg file, as they were documented by Scott, however they are not available in the current declude.exe as we move forward with adding additional tests these will very likely be activated in future releases. David B www.declude.com - Original Message - From: Colbeck, Andrew [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, April 12, 2005 5:50 PM Subject: RE: [Declude.JunkMail] DYNHELO Test From my own experimentation, I'd say that as of today in v2.0.6 DYNHELO is definitely working. IPURL and ENCODEDURL are definitely not working. The two URL based tests only show up in Debug mode as *not* being triggered. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Horne Sent: Tuesday, April 12, 2005 2:26 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Is it available now? Is it working in 2.0.6? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Tuesday, April 12, 2005 5:16 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Probably meant not available (at the time). Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Horne Sent: Tuesday, April 12, 2005 05:09 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] DYNHELO Test Why is IPURL listed as Currently N/A ? Not Applicable? To what? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
